Forum Discussion
SP Admin role cannot modify O365 groups programmatically
I have a customer where we only have SP Admin role. We don't have global admin rights. Recently MS granted SP Admin role the privileges to create/modify/delete O365 groups and add/remove their owners and members. I can use the Admin Center UI to create/delete/etc. O365 groups. If I try to use the Exchange Online powershell, I can create/import a session and run Get-UnifiedGroup successfully to view a list of O365 groups. However, when I try to run Set-UnifiedGroup or Add-UnifiedGroupLinks, I get "The term '...Unifiedgroup...' is not recognized as the name of a cmdlet...". These cmdlets aren't made available when you import the session. If the SP Admin role can do this thru the UI, shouldn't it be able to do the same thru Powershell?
PS: I also tried the PnP version but that's another issue with the scopes.
5 Replies
Why would you expect a SharePoint role to get access to additional Exchange cmdlets? The way I understand it, they've granted permissions on Azure AD and possibly the Graph API, which is what's executed from the O365 Admin center anyway. If you want to perform those tasks with the Exchange cmdlets, add the relevant roles (Mail Recipients is sufficient).
- It does have the privilege to do that. If it can do it using the UI, it should be able to do it thru the APIs as well. This might have been overlooked when SP Admin role was given additional privileges for O365 groups recently.
The O365 Admin center UI does NOT use Exchange PowerShell cmdlets to execute group-related tasks though, and having permissions in one tool/API doesn't necessarily mean you should get the corresponding permissions across all. You can always open an uservoice item or leave feedback on the documentation, or just add the relevant permissions yourself.
